Delete a secret
Removes the secret and its value. Pass `?projectId=` to delete the project-scoped secret of that name; without it the user-scoped secret is removed. Answers 404 for a secret that is not the caller's, the same as for one that does not exist.
Removes the secret and its value. Pass ?projectId= to delete the project-scoped secret of that name; without it the user-scoped secret is removed. Answers 404 for a secret that is not the caller's, the same as for one that does not exist.
Authorization
bearerAuth A bearer token. The Account routes accept a Privy access token; the MCP transport accepts an sk- API key issued by POST /account/api-keys.
In: header
Path Parameters
The environment-variable-shaped name of the secret. PRIVATE_KEY, MNEMONIC, and SEED_PHRASE are refused.
^[A-Z][A-Z0-9_]{0,63}$Query Parameters
Delete the project-scoped secret of this name.
1 <= lengthResponse Body
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/secrets/string"Read one secret's metadata GET
Returns one secret's metadata. There is no endpoint anywhere in the API that returns a value; this is the closest thing to one, and it stops at `lastUsedAt`. Pass `?projectId=` to read the project-scoped secret of that name rather than the user-scoped one.
Store or replace a secret (write-only) PUT
Stores `value` under `name`, replacing any existing value at the same scope. This is the only request in the API that carries a secret value, and the value is encrypted the moment it arrives: the response returns metadata only, and no route, tool, event, log, or export ever returns a value afterwards. Limits: 100 secrets per user and 8 KB per value, both enforced here. A value that looks like an EVM private key (64 hex characters, with or without `0x`) or a BIP-39 mnemonic (12-24 words) is refused, as are the names `PRIVATE_KEY`, `MNEMONIC`, and `SEED_PHRASE`: apps should use a wallet (Privy, or the user's own signing flow) instead.